skills/rit3zh/reacticx/using-reacticx/Gen Agent Trust Hub

using-reacticx

Pass

Audited by Gen Agent Trust Hub on Sep 22, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads component source code and configuration from an external registry hosted at github.com/rit3zh/reacticx and a public bucket at reacticx.com.- [COMMAND_EXECUTION]: The skill utilizes npx to execute the Reacticx CLI and the @reacticx/mcp server. It also invokes native build commands and dependency installers such as npx expo install and npx expo run:ios.- [INDIRECT_PROMPT_INJECTION]: The skill ingests third-party code and registry data from an external source, creating a vulnerability surface where remote content could influence agent behavior. \n
  • Ingestion points: The add_components, get_component_source, and list_components tools fetch content from the remote Reacticx registry. \n
  • Boundary markers: Source code retrieved from the registry is intended to be displayed within markdown code fences. \n
  • Capability inventory: The skill possesses the capability to perform file writes to the local project directory and execute shell commands via the npx utility. \n
  • Sanitization: The documentation indicates that the CLI verifies checksums for all downloads against a registry index hash.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 22, 2026, 12:50 PM